chore: release 9.7.0

[github-actions]

🤖 I have created a release beep boop

9.7.0

9.7.0 (2023-05-31)

Features

• a63a6d8 #6490 add provenanceFile option for libnpmpublish (@bdehamer)
• 2a8f4f2 #6490 add new exclusive config item publish-file (@wraithgar)
• 361e194 #6483 implement flag --prefer-dedupe for npm install (feat: implement flag --prefer-dedupe for npm install #6483) (@m4rch3n1ng)

Bug Fixes

• 38eb39b #6514 strip ansi characters from search results (fix: strip ansi characters from search results #6514) (@wraithgar)
• 4b5ccfc #6477 make usage and completion static functions (fix: make usage and completion static functions #6477) (@lukekarrys)
• 4f39e8c #6479 refactor engines validation to lint syntax (fix: refactor engines validation to lint syntax #6479) (@lukekarrys)
• f3cfe12 #6482 remove unused lib/npm relics (fix: remove unused lib/npm relics #6482) (@lukekarrys)
• 87de0c7 #6472 move explore command to @npmcli/package-json (@wraithgar)
• 636e29e #6472 move to @npmcli/package-json where possible (@wraithgar)
• 37cc797 #6418 retrieve registry keys via TUF (fix: retrieve registry keys via TUF #6418) (@bdehamer)

Documentation

• 83cd5bd #6480 add global option for uninstall (docs: add global option for uninstall #6480) (@m4rch3n1ng)
• 0400ce3 #6481 add cli params to npm set, npm get (docs: add cli params to npm set, npm get #6481) (@m4rch3n1ng)
• c3638ce #6468 remove package-lock option for npm ci (docs: remove package-lock option for npm ci #6468) (@m4rch3n1ng)

Dependencies

• 060d587 chalk@5.2.0, npm-audit-report@5.0.0
• fc52ca8 #6472 remove read-package-json-fast
• 3238aa7 #6472 remove read-package-json
• Workspace: @npmcli/config@6.2.0
• Workspace: libnpmexec@6.0.0
• Workspace: libnpmpublish@7.3.0

config: 6.2.0

6.2.0 (2023-05-31)

Features

• a63a6d8 #6490 add provenanceFile option for libnpmpublish (@bdehamer)
• 2a8f4f2 #6490 add new exclusive config item publish-file (@wraithgar)

libnpmexec: 6.0.0

6.0.0 (2023-05-31)

⚠️ BREAKING CHANGES

• require passing in chalk instance

Features

• 9e7f5ac require passing in chalk instance (@lukekarrys)

libnpmpublish: 7.3.0

7.3.0 (2023-05-31)

Features

• a63a6d8 #6490 add provenanceFile option for libnpmpublish (@bdehamer)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Release Manager

Release workflow run: https://github.com/npm/cli/actions/runs/5136462619

Force CI to Update This Release

This PR will be updated and CI will run for every non-chore: commit that is pushed to latest. To force CI to update this PR, run this command:

gh workflow run release.yml -r latest -R npm/cli -f release-pr=6470

Release Checklist for v9.7.0

• 1. Checkout the release branch

  Ensure git status is not dirty on this branch after resetting deps. If it is, then something is probably wrong with the automated release process.

  gh pr checkout 6470 --force

  node . run resetdeps

  node scripts/git-dirty.js

• 2. Check CI status

  gh pr checks --watch

• 3. Publish the CLI and workspaces

  Warning:
  This will publish all updated workspaces to latest, prerelease or backport depending on their version, and will publish the CLI with the dist-tag set to next-9.

  Note:
  The --test argument can optionally be omitted to run the publish process without running any tests locally.

  node scripts/publish.js --test

• 4. Optionally install and test npm@9.7.0 locally

  npm i -g npm@9.7.0

  npm --version
  npm whoami
  npm help install
  # etc

• 5. Set latest dist-tag to newly published version

  Warning:
  NOT FOR PRERELEASE: Do not run this step for prereleases or if 9 is not being set to latest.

  node . dist-tag add npm@9.7.0 latest

• 6. Trigger docs.npmjs.com update

  gh workflow run update-cli.yml --repo npm/documentation

• 7. Merge release PR

  gh pr merge --rebase

  git checkout latest

  git fetch

  git reset --hard origin/latest

  node . run resetdeps

• 8. Wait For Release Tags

  Warning:
  The remaining steps all require the GitHub tags and releases to be created first. These are done once this PR has been labelled with autorelease: tagged.

  Release Please will run on the just merged release commit and create GitHub releases and tags for each package. The release bot will will comment on this PR when the releases and tags are created.

  Note:
  The release workflow also includes the Node integration tests which do not need to finish before continuing.

  You can watch the release workflow in your terminal with the following command:

  gh run watch `gh run list -R npm/cli -w release -b latest -L 1 --json databaseId -q ".[0].databaseId"`
  

• 9. Open nodejs/node PR to update npm to latest

  Warning:
  You must wait for CI to create the release tags before running this step. These are done once this PR has been labelled with autorelease: tagged.

  Trigger the Create Node PR action. This will open a PR on nodejs/node to the main branch.

  Note:
  The resulting PR may need to be labelled if it is not intended to land on old Node versions.

  First, sync our fork of node with the upstream source:

  gh repo sync npm/node --source nodejs/node --force

  Then, if we are opening a PR against the latest version of node:

  gh workflow run create-node-pr.yml -f spec=next-9

  If the PR should be opened on a different branch (such as when doing backports) then run it with -f branch=<BRANCH_NAME>. There is also a shortcut to target a specific Node version by specifying a major version number with -f branch=18 (or similar).

  For example, this will create a PR on nodejs/node to the v16.x-staging branch:

  gh workflow run create-node-pr.yml -f spec=next-9 -f branch=16

• 10. Label and fast-track nodejs/node PR

  Note:
  This requires being a nodejs collaborator. Currently @lukekarrys is so ping them to do these steps!

  • Thumbs-up reaction on the Fast-track comment
  • Add an LGTM / Approval
  • Add request-ci label to get it running CI
  • Add commit-queue label once everything is green

[lukekarrys]

npm@9.7.0 was published but never tagged latest due to a bug found during step 4. below is a root cause of the bug, but the tl;dr is that npm@9.7.0 will be deprecated and npm@9.7.1 will be published once the bug is fixed.

we switched from read-package-json to @npmcli/package-json which recently received an update to bring all the features from the former to the latter. lost in this port was a minor change to normalizing package bins. previously we would not parse package.json#directories.bin if a package.json#bin was present (ref: https://github.com/npm/read-package-json/blob/main/lib/read-json.js#L351-L353) but now we do regardless of whether a bin object is there (ref: https://github.com/npm/package-json/blob/main/lib/normalize.js#L161)

next steps:

• deprecate npm@9.7.. this version exists on the registry and contains breaking changes that would impact users if you publish packages using both bin and directories.bin
• make a fix for this bug in @npmcli/package.json
• do a further analysis of the changes between read-package-json and @npmcli/package-json and assert this behavior in news tests to ensure no other breaking changes occurred
• do a new release for npm@9.7.1

[github-actions]

Release Workflow

• npm@9.7.0 https://github.com/npm/cli/releases/tag/v9.7.0
• libnpmexec@6.0.0 https://github.com/npm/cli/releases/tag/libnpmexec-v6.0.0
• libnpmpublish@7.3.0 https://github.com/npm/cli/releases/tag/libnpmpublish-v7.3.0
• @npmcli/config@6.2.0 https://github.com/npm/cli/releases/tag/config-v6.2.0
• Workflow run: ❌ https://github.com/npm/cli/actions/runs/5139693983

🚨 @npm/cli-team: The post-release workflow failed for this release. Manual steps may need to be taken after examining the workflow output from the above workflow run. 🚨